Home > Vulnerability Database > CVE-2009-2632

Mend.io Vulnerability Database

CVE-2009-2632

Date: September 8, 2009

Buffer overflow in the SIEVE script component (sieve/script.c), as used in cyrus-imapd in Cyrus IMAP Server 2.2.13 and 2.3.14, and Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, allows local users to execute arbitrary code and read or modify arbitrary messages via a crafted SIEVE script, related to the incorrect use of the sizeof operator for determining buffer length, combined with an integer signedness error.

Severity Score

4.9

Related Resources (26)

Url: https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00491.html

Url: http://secunia.com/advisories/36713

Url: https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001254.html

Url: http://www.vupen.com/english/advisories/2009/2641

Url: http://www.osvdb.org/58103

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10082

Url: http://secunia.com/advisories/36632

Url: http://secunia.com/advisories/36698

Url: https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sieve/script.c.diff?r1=1.62&r2=1.62.2.1&only_with_tag=cyrus-imapd-2_2-tail

Url: http://www.ubuntu.com/usn/USN-838-1

Url: http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2009-2632

Url: http://www.vupen.com/english/advisories/2009/2559

Url: http://www.openwall.com/lists/oss-security/2009/09/14/3

Url: http://secunia.com/advisories/36629

Url: http://secunia.com/advisories/36904

Url: https://nvd.nist.gov/vuln/detail/CVE-2009-2632

Url: http://support.apple.com/kb/HT4077

Url: http://www.securityfocus.com/bid/36296

Url: https://lists.andrew.cmu.edu/pipermail/cyrus-cvs/2009-September/001253.html

Url: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Url: http://www.securityfocus.com/bid/36377

Url: http://dovecot.org/list/dovecot-news/2009-September/000135.html

Url: https://access.redhat.com/security/cve/CVE-2009-2632

Url: http://www.debian.org/security/2009/dsa-1881

Url: https://www.mend.io/vulnerability-database/CVE-2009-2632

Severity Score

4.9

Weakness Type (CWE)

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-119

CVSS v3.1

Base Score:	4.9
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW

CVSS v2

Base Score:	4.4
Access Vector (AV):	LOCAL
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2009-2632

Date: September 8, 2009

Severity Score

Related Resources (26)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?